Hi All, SURBL is looking for statistics about what portion of unsolicited our lists are detecting (ideally in large mail flows). An overall number would be ideal, as in what fraction of total unsolicited messages are caught by any SURBL list. One possible way to measure this from SpamAssassin-processed messages would be to count the messages marked as spam that had 'SURBL' in their scores versus the ones that didn't have a SURBL rule hit. The ratio would be the spams with SURBL hits divided by total number of spams.
Another way would be to count the SURBL hits from an MTA milter, but to have the meaningful denominator, one would need a count of the total spams, which a simple SURBL-only milter would not be able to provide. Something else, or a more sophisticated milter would need to count the total spams in order to get the denominator.
Ideally the results would be after MTA blocking with a major sender blacklist like zen.spamhaus.org. Please let us know whether a sender blacklist is used in the MTA or not.
Any results would be greatly appreciated.
Cheers,
Jeff C.
Jeff Chan wrote:
Hi All, SURBL is looking for statistics about what portion of unsolicited our lists are detecting (ideally in large mail flows). An overall number would be ideal, as in what fraction of total unsolicited messages are caught by any SURBL list. One possible way to measure this from SpamAssassin-processed messages would be to count the messages marked as spam that had 'SURBL' in their scores versus the ones that didn't have a SURBL rule hit. The ratio would be the spams with SURBL hits divided by total number of spams.
Another way would be to count the SURBL hits from an MTA milter, but to have the meaningful denominator, one would need a count of the total spams, which a simple SURBL-only milter would not be able to provide. Something else, or a more sophisticated milter would need to count the total spams in order to get the denominator.
Ideally the results would be after MTA blocking with a major sender blacklist like zen.spamhaus.org. Please let us know whether a sender blacklist is used in the MTA or not.
Any results would be greatly appreciated.
Hi,
From about a weeks worth of data with the MTA blocking using 3 sender blacklists. There are 2 separate MXs with 2 spamd machines in round robin.
[spa010 spamd]# grep "identified spam" * | wc -l - Spam 57993 [spa010 spamd]# grep SURBL * | wc -l - SURBL hits 43077 [spa010 spamd]# grep bytes * | wc -l - Total Messages 180763
Regards,
Rick
At 05:29 AM Saturday, 10/18/2008, you wrote -=>
Jeff Chan wrote:
Hi All, SURBL is looking for statistics about what portion of unsolicited our lists are detecting (ideally in large mail flows). An overall number would be ideal, as in what fraction of total unsolicited messages are caught by any SURBL list. One possible way to measure this from SpamAssassin-processed messages would be to count the messages marked as spam that had 'SURBL' in their scores versus the ones that didn't have a SURBL rule hit. The ratio would be the spams with SURBL hits divided by total number of spams.
Another way would be to count the SURBL hits from an MTA milter, but to have the meaningful denominator, one would need a count of the total spams, which a simple SURBL-only milter would not be able to provide. Something else, or a more sophisticated milter would need to count the total spams in order to get the denominator.
Ideally the results would be after MTA blocking with a major sender blacklist like zen.spamhaus.org. Please let us know whether a sender blacklist is used in the MTA or not.
Any results would be greatly appreciated.
Hi,
From about a weeks worth of data with the MTA blocking using 3 sender blacklists. There are 2 separate MXs with 2 spamd machines in round robin.
[spa010 spamd]# grep "identified spam" * | wc -l - Spam 57993 [spa010 spamd]# grep SURBL * | wc -l - SURBL hits 43077 [spa010 spamd]# grep bytes * | wc -l - Total Messages 180763
Hello,
FWIW, we run a small server with only a few users and low traffic but I grep'd a couple of weeks worth of logs. One MX, one machine, with MTA blocking using 3 blacklists, access.db and Sendmail RDNS. I actually wind up blocking more at the MTA using RDNS than ever before.
[yoda spamd]# grep "identified spam" /var/log/maillog* | wc -l -Spam 5562 [yoda spamd]# grep SURBL /var/log/maillog* | wc -l 3581 - SURBL Hits [yoda spamd]# grep bytes /var/log/maillog* | wc -l 22139 - Total Messages
HTH,
Ed
........................................................................... Randomly Generated Quote (378 of 1466): According to my best recollection, I don't remember. - Vincent "Jimmy Blue Eyes" Alo
Jeff Chan a écrit :
Hi All, SURBL is looking for statistics about what portion of unsolicited our lists are detecting (ideally in large mail flows). An overall number would be ideal, as in what fraction of total unsolicited messages are caught by any SURBL list. One possible way to measure this from SpamAssassin-processed messages would be to count the messages marked as spam that had 'SURBL' in their scores versus the ones that didn't have a SURBL rule hit. The ratio would be the spams with SURBL hits divided by total number of spams.
Another way would be to count the SURBL hits from an MTA milter, but to have the meaningful denominator, one would need a count of the total spams, which a simple SURBL-only milter would not be able to provide. Something else, or a more sophisticated milter would need to count the total spams in order to get the denominator.
Ideally the results would be after MTA blocking with a major sender blacklist like zen.spamhaus.org. Please let us know whether a sender blacklist is used in the MTA or not.
Any results would be greatly appreciated.
checking last junk folders - total: 11934 - surbl: 5554
so that's a 46.53 %
this junk is what passed postfix or was received via fetchmail or from a trusted forwarder (very little)
On Oct 18, 2008, at 9:29 AM, Jeff Chan wrote:
Hi All, SURBL is looking for statistics about what portion of unsolicited our lists are detecting (ideally in large mail flows). An overall number would be ideal, as in what fraction of total unsolicited messages are caught by any SURBL list. One possible way to measure this from SpamAssassin-processed messages would be to count the messages marked as spam that had 'SURBL' in their scores versus the ones that didn't have a SURBL rule hit. The ratio would be the spams with SURBL hits divided by total number of spams.
Another way would be to count the SURBL hits from an MTA milter, but to have the meaningful denominator, one would need a count of the total spams, which a simple SURBL-only milter would not be able to provide. Something else, or a more sophisticated milter would need to count the total spams in order to get the denominator.
Ideally the results would be after MTA blocking with a major sender blacklist like zen.spamhaus.org. Please let us know whether a sender blacklist is used in the MTA or not.
The following are my numbers for the last few days. Cosider that SURBL blocks happen after a very complete envelope filtering ruleset: Spamhaus, Spamcop, local DNSBLs and sender domain filters, several HELO-based filters, header-checks against known spamware patterns and so on.
So, every SURBL block probably happens where no envelope-based or header-based rule applies, like in botnet spam relayed through legit mailservers; even if the overall numbers are low, those blocks are nontheless vital for the ruleset, since SURBL blocks are only followed by our local URI-based DNSBL and AV scans.
I'm just reporting numbers of total reject, spamhaus rejects (each sub-list happening in different parts of the ruleset, not querying Zen as a whole...) and SURBL rejects:
Day Rejects Spamhaus SURBL 2008-10-07 1420832 1120226 9686 2008-10-09 1490590 1186971 11489 2008-10-10 1705009 1348736 8556 2008-10-11 1526548 1210702 2663 2008-10-12 1074636 863936 2919 2008-10-13 1171171 916355 2826 2008-10-14 1312566 1015615 2540 2008-10-15 1344592 1039028 2430 2008-10-16 2072244 1690267 2678 2008-10-17 1053814 823683 2345
HTH
Bye!
From Oct 1 through half of the 18th.
This is via SA, which is the last in line after grey listing, URLBL checks & virus scanning, all of which will reject messages before SA sees them:
SURBL in email marked as SPAM: 270 Total email marked as SPAM: 14,173 % SURBL SPAM messages: 1.9%
Other info: SURBL in email marked as HAM: 33 Total email marked as HAM: 109,095
Benji Spencer System Administrator
Moody Bible Institute Phone: 312-329-2288 Fax: 312-329-8961
-----Original Message----- From: discuss-bounces@lists.surbl.org [mailto:discuss- bounces@lists.surbl.org] On Behalf Of Jeff Chan Sent: Saturday, October 18, 2008 2:29 AM To: SURBL Discuss Subject: [SURBL-Discuss] Stats wanted
Hi All, SURBL is looking for statistics about what portion of unsolicited our lists are detecting (ideally in large mail flows). An overall number would be ideal, as in what fraction of total unsolicited messages are caught by any SURBL list. One possible way to measure this from SpamAssassin-processed messages would be to count the messages marked as spam that had 'SURBL' in their scores versus the ones that didn't have a SURBL rule hit. The ratio would be the spams with SURBL hits divided by total number of spams.
Another way would be to count the SURBL hits from an MTA milter, but to have the meaningful denominator, one would need a count of the total spams, which a simple SURBL-only milter would not be able to provide. Something else, or a more sophisticated milter would need to count the total spams in order to get the denominator.
Ideally the results would be after MTA blocking with a major sender blacklist like zen.spamhaus.org. Please let us know whether a sender blacklist is used in the MTA or not.
Any results would be greatly appreciated.
Cheers,
Jeff C. _______________________________________________ Discuss mailing list Discuss@lists.surbl.org http://lists.surbl.org/mailman/listinfo/discuss
Hi Jeff,
Jeff Chan wrote:
Hi All,
Ideally the results would be after MTA blocking with a major sender blacklist like zen.spamhaus.org. Please let us know whether a sender blacklist is used in the MTA or not.
Any results would be greatly appreciated.
Running the yesterday night version of surbl on the spams I received on my own maibox this month :
* SPAMS : 14746 * FN : 4450 * FNR : 0.30178
That means 10296 messages with 2324 different domains. I'm attaching a file with the list of these domains with the number of hits of each domain.
I don't have the detection rate for our domain, but maybe I can do something to get it in the future, not in the past.
P.S. - I'm sending this message to the list and to you, as I think the list server will block this message, as it has an attached file.
Regards
Joe
On 18 Oct 2008, at 08:29, Jeff Chan wrote:
Hi All, SURBL is looking for statistics about what portion of unsolicited our lists are detecting (ideally in large mail flows). An overall number would be ideal, as in what fraction of total unsolicited messages are caught by any SURBL list. One possible way to measure this from SpamAssassin-processed messages would be to count the messages marked as spam that had 'SURBL' in their scores versus the ones that didn't have a SURBL rule hit. The ratio would be the spams with SURBL hits divided by total number of spams.
Another way would be to count the SURBL hits from an MTA milter, but to have the meaningful denominator, one would need a count of the total spams, which a simple SURBL-only milter would not be able to provide. Something else, or a more sophisticated milter would need to count the total spams in order to get the denominator.
Ideally the results would be after MTA blocking with a major sender blacklist like zen.spamhaus.org. Please let us know whether a sender blacklist is used in the MTA or not.
Any results would be greatly appreciated.
Cheers,
Jeff
Here are some stats from our platform for the last 24 hours. If you're interested in a longer sample range then let me know and I can set something up.
We use Spamhaus at the MTA to reject at SMTP time. This usually removes approximately 25 to 50% of inbound messages before they get through to the SpamAssassin layer.
"Identified spam": 3,115,493
Messages that had a "SURBL" hit: 2,381,824
Messages processed: 6,052,806
Regards
Paul
Jeff Chan wrote:
Hi All, SURBL is looking for statistics about what portion of unsolicited our lists are detecting (ideally in large mail flows). An overall number would be ideal, as in what fraction of total unsolicited messages are caught by any SURBL list. One possible way to measure this from SpamAssassin-processed messages would be to count the messages marked as spam that had 'SURBL' in their scores versus the ones that didn't have a SURBL rule hit. The ratio would be the spams with SURBL hits divided by total number of spams.
Another way would be to count the SURBL hits from an MTA milter, but to have the meaningful denominator, one would need a count of the total spams, which a simple SURBL-only milter would not be able to provide. Something else, or a more sophisticated milter would need to count the total spams in order to get the denominator.
Ideally the results would be after MTA blocking with a major sender blacklist like zen.spamhaus.org. Please let us know whether a sender blacklist is used in the MTA or not.
Any results would be greatly appreciated.
Results from the last 4 weeks. We don't do any blocking prior to spamassassin.
cat maillog* | grep "identified spam" | wc -l 151881 - spam mails cat maillog* | grep "SURBL" | wc -l 105266 - mails with surbl hitting [root@mail3 log]# cat maillog* | grep SURBL | grep "result: Y" | wc -l 105191 - mails with surbl that is marked as spam cat maillog* | grep bytes | wc -l 205660 - total mails
Bjorn
Jeff Chan wrote:
Hi All, SURBL is looking for statistics about what portion of unsolicited our lists are detecting (ideally in large mail flows). An overall number would be ideal, as in what fraction of total unsolicited messages are caught by any SURBL list. One possible way to measure this from SpamAssassin-processed messages would be to count the messages marked as spam that had 'SURBL' in their scores versus the ones that didn't have a SURBL rule hit. The ratio would be the spams with SURBL hits divided by total number of spams.
Another way would be to count the SURBL hits from an MTA milter, but to have the meaningful denominator, one would need a count of the total spams, which a simple SURBL-only milter would not be able to provide. Something else, or a more sophisticated milter would need to count the total spams in order to get the denominator.
Ideally the results would be after MTA blocking with a major sender blacklist like zen.spamhaus.org. Please let us know whether a sender blacklist is used in the MTA or not.
Postfix does not do any RBL checks, but does do greylisting and invalid hostname/helo blocking. For comparison purposes, here are my stats from this past weekend all URIBL tests I run (I've placed an * before the SURBL test results):
3 URIBL_RED 11 URIBL_GREY 227 URIBL_RHS_DOB 229 URIBL_SBL * 246 URIBL_SC_SURBL * 256 URIBL_AB_SURBL * 274 URIBL_WS_SURBL 294 URIBL_JMF_DOB * 733 URIBL_OB_SURBL * 1181 URIBL_JP_SURBL 1385 URIBL_JMF_BL 1674 URIBL_BLACK 2916 Messages Containing URI 3221 Total Messages Count
Bill
-
Ben Spencer -
Bill Landry -
Bjorn Jensen -
Ed Kasky -
Jeff Chan -
Jose-Marcio Martins da Cruz -
mouss -
Paul Shields -
Rick Macdougall -
skull＠spin.it